registry / Remote code execution / browselucide

browselucide

This report shows the evidence for browselucide@1.0.4. 1 of 2 known versions is blocked or flagged. The newest version, 1.0.5, is flagged. See all versions.

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

The package embeds an undisclosed external script and an obfuscated fetch-plus-new-Function loader activated by opening its page. This is a concrete remote code execution surface, not merely a benign browser dependency.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

A user opens or serves index.html.

Impact

Arbitrary JavaScript can run in the visitor's browser origin.

Mechanism

page-load remote script injection and dynamic remote-code execution

Attack narrative

When the included web page is opened, it immediately loads JavaScript from c.vipersfutbol.com. Its obfuscated main bundle also fetches a computed URL and invokes new Function on reconstructed values, creating a remote-controlled execution path in the page context. There is no npm install hook, but the runtime behavior is concrete and unsafe.

AI rationale

Evidence

index.htmlassets/index-_E4fBqHJ-eac502ad.jspackage.json

Network endpoints1

c.vipersfutbol.com/script.js

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

index.html loads an untrusted external script from c.vipersfutbol.com on page load.
The primary bundled entry is heavily obfuscated and invokes new Function with reconstructed values.
The same entry fetches a computed remote URL, enabling remotely supplied runtime behavior.

Evidence against

package.json contains only name and version; no npm lifecycle hooks or Node entrypoints are declared.
No install-time filesystem or process-execution behavior was found.

Behavioral surface

Source

ChildProcessDynamicRequireFilesystemNetworkWebSocket

Supply chain

HighEntropyStringsMinifiedObfuscatedProtestwareUrlStrings

Manifest

NoLicense

scanned 22 file(s), 6.69 MB of source, external domains: 127.0.0.1, aomediacodec.github.io, cdn.jsdelivr.net, cloud-api.livekit.io, curl.se, emscripten.org, fingerprint.com, github.com, m1.openfpcdn.io, react.dev, twemoji.maxcdn.com, www.w3.org, www.zlib.net

Source & flagged code

5 flagged

assets/livekit-DqpdvE-G-eac502ad.jsView file

13patternName = generic_password severity = medium line = 13 matchedText = `},e.par...+`\r

Medium

Secret Pattern

Package contains a possible secret pattern.

assets/livekit-DqpdvE-G-eac502ad.jsView on unpkg · L13

7cpa7/m20fhz.jsView file

Lines 1-31javascript

1(()=>{let e,t;var r,i,n,s,o,a,A={8770(e,t,r){var i={"./":"6418","./client":"6039","./client.ts":"6039","./dom/attr":"8806","./dom/attr.ts":"8806","./dom/beacon":"7265","./dom/beacon.ts":"7265","./dom/cookie":"8227","./dom/cookie.ts":"8227","./dom/css":"8114","./dom/css.ts":"8114","./dom/document":"6820","./dom/document.ts":"6820","./dom/element":"1733","./dom/element.ts":"1733","./dom/fontface":"737","./dom/fontface.ts":"737","./dom/fragments":"2452","./dom/fragments.ts":"2452","./dom/history":"4397","./dom/history.ts":"4397","./dom/open":"5421","./dom/open.ts":"5421","./dom/origin":"8703","./ ...

3// SCRAMJET FUNCTION INTERCEPT

4// target: ${e}

5// frame: ${r}

6// location: ${s}

8function apply(fn, that, args) {

9 return Reflect.apply(fn, that, args);

10}

12function construct(fn, args, newTarget) {

13 return Reflect.construct(fn, args, newTarget);

14}

16return { apply, construct };

18//# sourceURL=${A}`)();n=c,o=l}else n=g.z$,o=g.Mt;r.construct&&(l.construct=function(e,t,i){let n,s=!1,a={fn:e,this:null,args:t,newTarget:i,return:e=>{s=!0,n=e},call:()=>(s=!0,n=o(a.fn,a.args,a.newTarget))};return(r.construct(a),s)?n:o(a.fn,a.args,a.newTarget)}),r.apply&&(l.apply=(e,t,i)=>{let s,o=!1,a={fn:e,this:t,args:i,newTarget:null,return:e=>{o=!0,s=e},call:()=>(o=!0,s=n(a.fn,a.this,a.args))};if(!this.flagEnabled("debugTrampolines")&&this.flagEnabled("allowFailedIntercepts"))return(r.apply(a),o)?s:n(a.fn,a.this,a.args);let A=g.$D.prepareStackTrace,l=this;g.$D.prepareStackTrace=function(e, ...

19//# sourceURL=${r.url.href}`),n}return o.body;case"style":return(0,i.sM)(await o.text(),e.context,r.meta);case"sharedworker":case"worker":return(0,i.iP)(new Uint8Array(await o.arrayBuffer()),o.url,e.context,r.meta,r.isModule);default:return o.body}}},6967(e,t,r){r.d(t,{A4:()=>u});var i=r(3235),n=r(5657),s=r(7492),o=r(4e3),a=r(2967),A=r(7959),l=r(3129),c=r(49),h=r(5994);async function u(e,t){var r;let i,u=(0,s.T)(t,e);if("blob:"===(r=u.url).protocol||"data:"===r.protocol)return d(e,t,u);let m={};if(await l.C.dispatch(e.hooks.fetch.intercept,{request:t,parsed:u},m),m.response)return m.response;i ...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

7cpa7/m20fhz.jsView on unpkg · L17

20 background-color: ${{log:"#000",warn:"#f80",error:"#f00",debug:"transparent"}[e]};

21 color: ${{log:"#fff",warn:"#fff",error:"#fff",debug:"gray"}[e]};

22 padding: ${{log:2,warn:4,error:4,debug:0}[e]}px;

23 font-weight: bold;

24 font-family: monospace;

25 font-size: 0.9em;

26 `,`${"debug"===e?"color: gray":""}`,...i)},log:function(e,...t){this.fmt("log",e,...t)},warn:function(e,...t){this.fmt("warn",e,...t)},error:function(e,...t){this.fmt("error",e,...t)},debug:function(e,...t){this.fmt("debug",e,...t)},time(e,t,r){let n,s=(0,i.wU)()-t;n=s<1?"BLAZINGLY FAST":s<500?"decent speed":"really slow",this.print("debug","[time]",`${r} was ${n} (${s.toFixed(2)}ms)`)}}},6372(e,t,r){r.d(t,{c:()=>s});var i=r(5994),n=r(2075);class s{cookies={};byDomain=new Map;defaultPath(e){let t=e.pathname;if(!t||!t.startsWith("/"))return"/";let r=t.lastIndexOf("/");return r<=0?"/":t.slice( ...

27${e}`):`${e}

28${c}`}}if((0,i.U5)("rewriterLogs",r,n.base))for(let e of A.errors)o.error("oxc parse error",e);return c}catch(a){if(o.warn("failed rewriting js for",t||"(unknown)",a.message,"string"!=typeof e

29`:`importScripts("${e}");

30`,c=r.interface.getWorkerInjectScripts(a,A,l),h=(0,n.o)(e,t,r,a,A);if("string"!=typeof h&&(h=(0,s.hS)(h)),(0,i.U5)("encapsulateWorkers",r,a.origin)){let e;h+=`//# sourceURL=${t}`,c+=l((e=h,`data:text/javascript;charset=utf-8;base64,${(0,o.K)(e)}`))}else c+=h;return c}},2075(e,t,r){r.d(t,{Ay:()=>o});let i=new TextEncoder;function n(e){return"string"==typeof e&&!!e.trim()}function s(e){for(let t=0;t<e.length;t++){let r=e.charCodeAt(t);if((r>=0&&r<=31||127===r)&&9!==r)return!0}return!1}let o=function(e){return n(e)?[e].map(e=>(function(e){var t,r,o;let a,A,l,c=e.split(";"),h=c.shift();if(!h||!h.t ...

31//# sourceMappingURL=scramjet.js.map

Long lines were clipped for display.

assets/index-_E4fBqHJ-eac502ad.jsView file

1(function(_0x33e283,_0x3f1117){const _0x2edf25={_0x1053f2:0x468,_0x11ba7e:0x1f1,_0x1344bd:0x291,_0x4ea311:0xdf3,_0x718669:0xcc6,_0x20031d:0x89e,_0xc7b29e:0x21c,_0xe686a4:0x1008,_0x...

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

assets/index-_E4fBqHJ-eac502ad.jsView on unpkg · L1

7cpa7/vpa1gg.wasmView file

•path = 7cpa7/vpa1gg.wasm kind = wasm_module sizeBytes = 586279 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

7cpa7/vpa1gg.wasmView on unpkg

assets/fingerprint-Y5nV5FVa-eac502ad.jsView file

•matchType = normalized_sha256 matchedPackage = crazynut@2.0.0 matchedPath = assets/fingerprint-Y5nV5FVa.js matchedIdentity = npm:Y3JhenludXQ:2.0.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

assets/fingerprint-Y5nV5FVa-eac502ad.jsView on unpkg

Source & flagged code

5 flagged · loading source

assets/livekit-DqpdvE-G-eac502ad.jsView file

13patternName = generic_password severity = medium line = 13 matchedText = `},e.par...+`\r

Medium

Secret Pattern

Package contains a possible secret pattern.

assets/livekit-DqpdvE-G-eac502ad.jsView on unpkg · L13

7cpa7/m20fhz.jsView file

17L18: //# sourceURL=${A}`)();n=c,o=l}else n=g.z$,o=g.Mt;r.construct&&(l.construct=function(e,t,i){let n,s=!1,a={fn:e,this:null,args:t,newTarget:i,return:e=>{s=!0,n=e},call:()=>(s=!0,n=o(... L19: //# sourceURL=${r.url.href}`),n}return o.body;case"style":return(0,i.sM)(await o.text(),e.context,r.meta);case"sharedworker":case"worker":return(0,i.iP)(new Uint8Array(await o.arra...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

7cpa7/m20fhz.jsView on unpkg · L17

assets/index-_E4fBqHJ-eac502ad.jsView file

Findings

3 High6 Medium4 Low

HighObfuscated Payload Loaderassets/index-_E4fBqHJ-eac502ad.js

HighObfuscated

HighKnown Malware Source Similarityassets/fingerprint-Y5nV5FVa-eac502ad.js

MediumSecret Patternassets/livekit-DqpdvE-G-eac502ad.js

MediumDynamic Require7cpa7/m20fhz.js

MediumNetwork

MediumProtestware

MediumShips Wasm Module7cpa7/vpa1gg.wasm

MediumStructural Risk Force Deep Review

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Affected versions and remediation

This report applies to browselucide@1.0.4.

The versions list below shows the verdict for each recorded version.

Avoid installing browselucide@1.0.4. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-08-17 17:54:04.220Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

2 known versions

1.0.5latestSuspiciousRemote Code ExecutionWarnPublishedSep 2, 2026, 12:50 AM 1.0.4shownMaliciousRemote Code ExecutionBlockPublishedAug 17, 2026, 4:46 PM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other remote code execution packages

Related packages

Other remote code execution packages

Source & flagged code